Security researchers have disclosed DDRop, a low-cost hardware attack that can undermine confidential-computing protections in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP systems.
The attack uses a custom DDR5 memory interposer costing about $159 in parts and requires privileged software access plus brief physical access to the target server.
Trusted Execution Environments, or TEEs, are designed to protect sensitive workloads from cloud providers, hypervisors, and other highly privileged software.
Intel TDX and AMD SEV-SNP encrypt virtual-machine memory, making it difficult for a malicious host administrator to directly read protected data.
DDRop Breaches Intel AMD TEEs
However, the researchers found that these platforms lack cryptographic freshness protection. In simple terms, the processor can verify that encrypted memory data appears valid, but it may not detect that the data is old.
This creates an opening for a physical attacker to force a protected workload to use stale memory contents. DDRop places a small device between a server CPU and a DDR5 Registered DIMM.
The device interferes with DDR5 memory commands at normal operating speeds. It deliberately causes parity errors on the command bus and disconnects the alert signal that would normally notify the CPU of the error.
As a result, the memory module silently ignores selected write commands. The CPU believes it has written new encrypted data to memory, but the old data remains. When the protected virtual machine later reads that location, it may receive the stale encrypted value without detecting the rollback.
Unlike prior DDR5 bus attacks that relied on costly logic analyzers or reduced memory speeds, DDRop operates at native DDR5 speeds using a compact custom interposer and a Teensy 4.1 microcontroller.
The bill of materials lists a total cost of $159 for a system built at scale, excluding labor and research costs. The researchers demonstrated attacks against updated Intel TDX and AMD SEV-SNP platforms.
They showed that a malicious host could abuse page-relocation operations to copy plaintext between protected memory pages. This could enable memory rollback, data manipulation, or leakage through ciphertext side channels.
On Intel TDX, the team went further. By suppressing initialization writes to Secure Extended Page Table entries, they injected malicious page-table data.
This allowed them to access protected ciphertext, place a Trust Domain into debug mode, and forge attestation reports containing an attacker-chosen workload measurement. Remote users could therefore be misled into trusting a backdoored confidential VM.
The attack is not remote-only. An adversary needs control of privileged host software and one-time physical access to install the interposer, such as during server maintenance.
The researchers tested it mainly on dual-socket servers, where they could isolate the targeted memory region and avoid disrupting critical host operations, ddropattack said.
Short-term defenses include checking memory-training timing for unexpected hardware delays, performing runtime write-and-read-back validation, hardening memory-management APIs, and disabling optional page-swapping functions where possible.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
